Cybersecurity researchers have disclosed details of what appears to be an artificial intelligence (AI)-assisted attack orchestrated by a suspected China-linked threat actor that exploited vulnerabilities in PHP2Shell to hack exposed systems.
The activity, observed on October 25, 2026, involved an attacker combining PHP2Shell with a kernel privilege escalation exploit to root 25 servers, including three systems in a US government-affiliated environment.
“The affected devices are running specific versions of a major vendor’s firewall software,” cybersecurity company Dream said. “The attacker then launched attacks against Active Directory. The recovered artifacts confirm credential extraction and directory enumeration.”
The name of the seller involved was not disclosed, but the Israeli company said it had informed the entity. The attack chain essentially brings together two sets of vulnerabilities impacting PHP and the Linux kernel –
- PHP2Shella pair of flaws identified as CVE-2026-109618 and CVE-2026-109619 (CVSS scores: 9.2) that could lead to unauthenticated remote code execution.
- Fragnesiea local elevation of privilege vulnerability in the Linux kernel identified as CVE-2026-46300 (CVSS score: 7.8)
“The implementation we recovered is a custom, non-public version, and not a copy of a known public exploit for PHP2Shell,” Dream researchers explained. “It follows the same underlying concept but appears to have been independently developed and specifically tailored to the targeted firewall platform.”
“The vulnerability targets PHP’s session.upload_progress mechanism on the firewall’s appweb management server. The firewall’s operating system uses PHP 8.0.30 with a high memory limit that enables the memory corruption stages of the attack.”
The custom weaponization of the PHP2Shell exploit chain, coupled with CVE-2026-46300, reportedly rooted 25 servers in the United States, Japan, Taiwan, and South Korea.
Artifacts discovered by Dream indicate that the operation began by developing exploits in a lab environment before gaining persistent access to the internal Active Directory domain of a US government organization.
“Once rooted, the attacker focused on three specific servers in a US government-affiliated environment,” the company noted.
Links to AI-assisted tools come from evidence indicating the installation of Anthropic’s Claude code in the attack infrastructure, as well as the presence of API keys for FOFA and an AI-based offensive security platform called aiscan configured with extended language models (LLM) from DeepSeek and Kimi.
Additionally, the code structure, commenting style, and consistency of nearly 40 scripts suggest the use of AI to augment the development process. The whole operation, according to Dream, goes as follows:
- The attacker uses FOFA to identify approximately 19,000 Internet firewalls with exposed management interfaces worldwide.
- A custom version analyzer is run to determine which of these devices are online and what version of the operating system they are running. About 5,000 devices respond with version information.
- The attacker filters servers to those located in the United States, Japan, Taiwan, and South Korea, then limits the scope to systems that match the most recent branches running PHP 8.0.30. This step gives 240 targets.
- The list of targets is passed as input to an automated batch executor that leverages the PHP2Shell-Fragnesia chain, installs a PHP web shell in a publicly accessible directory on the firewall, checks for root access, and logs the target’s hostname and IP address to a CSV file. This step allows the attacker to gain root access to 24 servers.
- Two of the successfully compromised systems are identified as belonging to an organization affiliated with the US government. One of them crashes shortly after being rooted on October 23, 2026 at 6:14 PM UTC and never comes back online. The attacker is carrying out a dedicated campaign to successfully root a second system on October 24, 2026 at 10:09 UTC.
- The attacker exploits the second system to create a persistent channel in the internal network via a reverse SSH tunnel connecting the compromised firewall to the operator’s infrastructure. At 11:35 UTC, a third government server is compromised using the same method, the only difference being that it is an internal firewall management server accessible only through the tunnel. The total number of rooted servers reaches 25.
- The attacker targets Active Directory to crack the LDAP service account password, enumerate users, and password spray each user account using organization-themed passwords in an attempt to extract credentials. The operation also attempts to create backdoor Active Directory accounts.
It is unclear whether the activity allowed the threat actor to find valid credentials or create hijacked accounts. As a result, the true scope of the compromise remains undetermined.
“Given that the United States, Japan, Taiwan, and South Korea are the four primary strategic adversaries and intelligence targets for Chinese state-aligned cyber operations in the Pacific theater, this indicates potential efforts by nation-state adversaries,” Dream said.
“The operation illustrates how an exposed management interface can become a path to an organization’s identity infrastructure. The other 22 rooted firewalls remain parked with active web shells. The persistent tunnel to the U.S. government organization is likely still running. And the attacker still has 19,000 fingerprint targets that he can revisit as he develops profiles for additional versions of the operating system.”
This disclosure comes as PHP2Shell vulnerabilities have seen only limited exploitation in the wild, with malicious actors highlighting the challenges of converting a proof of concept (PoC) into a reliable attack vector against real-world targets, despite integrating them into their campaigns.
“In practice, this is unexploitable crap. To exploit real targets, you need libphp.so offsets, which are unique to each build and impossible to brute force. You can reproduce it on your own testbed, or if you already have access to the target’s filesystem,” said a member who goes by the name c0d3x on the XSS forum, according to Flare.
Gn bussni
